4 ms·

I want to love FreeBSD, but there are some things I wished were easier. Like getting the firewall pf set up. When I install Debian with ufw I get a really nice

I want to love FreeBSD, but there are some things I wished were easier. Like getting the firewall pf set up. When I install Debian with ufw I get a really nice starting ruleset that works well with IPv6 and good ICMP filtering etc. With FreeBSD I was confused for awhile about how to get IPv6 working with (the very powerful) pf, which you have to write a config file completely from scratch for. I was left with a lot of suggestions and snippets but struggling to dig through the man pages and set all the complex rules for which types of ICMP messages to filter, etc. I wish there was an easier way to get going with the firewall with a good ready-made pf.conf file for a web server that works well with IPv6. Yes the power and easy customability of pf is great. But for many users who aren't network experts, some nice, accepted starting templates would be great.

deleted 3y ago
[deleted]
BSDobelix 3y ago
Well there are some examples: https://github.com/freebsd/freebsd-src/tree/main/share/examples/pf https://github.com/freebsd/freebsd-src/tree/main/share/examp... But yeah that pf.conf could be expanded allot, but there are many source to cobble a conf together. My conf is massive but 99.9% commented out so i have my "template" for nearly everything, from mail to web to blacklistd etc.
- torstenvl 3y ago
  Have you considered putting your conf on GitHub? One of my most popular repos (which isn't saying a lot) is a single config file.
  - BSDobelix 3y ago
    Let me think about it..it's really massive and has comments like "*uck that if scrub on" or "set aggressive -> emailservers try and try again" and those are the best understandable comments believe me. All is mixed from highly reliable and fast connections to dial-up "industry" stuff. However that would be a good motivation to clean that monster up...hmmm
    - tambourine_man 3y ago
      Do it! :)
- adamddev1 3y ago
  Those are great but I don't see anything for a web server. Would just love a webserver that works with IPv6 and handles all the ICMP filtering like ufw does out of the box.
gerdesj 3y ago
"Like getting the firewall pf set up" pfSense 2.7.0 is FreeBSD 14 based already and 2.7.1 was released todayish. You could try tearing their scripts apart to see what's what but bear in mind that pfSense is designed to be a router/firewall not a host based firewall, which sounds like what you really want. It sounds like you want ufw or firewalld for FreeBSD. No idea if it exists and I am well passed DIY - I had custom scripts for ipfw, ipchains and iptables on Linux and then gave up. I don't use FreeBSD on the desktop but if I did ... https://www.digitalocean.com/community/tutorials/how-to-configure-packet-filter-pf-on-freebsd-12-1 https://www.digitalocean.com/community/tutorials/how-to-conf... or keep it simple: https://www.digitalocean.com/community/tutorials/recommended-steps-for-new-freebsd-12-0-servers#how-to-configure-a-simple-ipfw-firewall https://www.digitalocean.com/community/tutorials/recommended... You mention a web server. I suggest you keep the host firewall simple, this is in pseudo code: allow ssh from LAN allow monitoring_ip to monitoring_ports drop blocklist_ips to ALL allow https from ALL to webserver_ip deny all Your external router should keep most things out, the host firewall is a last resort. If you have a flat LAN, then this will keep your TV out etc. I have seen a TV port scan my home network, multiple times. If you can, consider deploying multiple VLANs. This does raise the technical bar somewhat! Host firewalls are just as good for small setups. Decide on what your security requirements really are and work on from there. I will grant you that is quite tricky for the uninitiated but keep asking questions and ducking the inevitable "RTFM" style answers from entitled numbskulls and you will get there. Good luck 8)
- adamddev1 3y ago
  Thanks, I used that Digital Ocean tutorial, but it doesn't get into the ICMP filtering enough, which you need for IPv6. And the pseudo code you shared is nice, but again, IPv6 will not work with that. ufw comes with a base ruleset with like 100ish lines of complex ICMP filtering. It's difficult/impossible to expect everyone to be able to write something like that from scratch in a syntax like pf. I just wish there was a complete, good template out there, but I haven't found anything.
  - gerdesj 3y ago
    ICMPv6 was designed to be a bit more robust than the v4 variant and I believe it is considered OK to allow all. I have six WANs at work - four FTTC 80/20Mbs-1, a 1Gbs-1 leased line and a 1000/300Mbs-1 FTTP job. All have IPv6 apart from the FTTP. I only push through the leased line /48 to inside but I do experiments with the IPv6 on the others. I have a /56 IPv6 at home too, for at least 10 years. I have allowed all ICMPv6 on two out of the four FTTC lines and not noticed much difference. The other two only allow "useful" ICMP, where useful is similar to this: http://firehol.org/guides/icmpv6-recommendations/ http://firehol.org/guides/icmpv6-recommendations/ Let your external router do the hard work. Your web server on the inside should allow all ICMPv6 in both directions. Just because it has a globally routeable IPv6 address(es) it is not on the outside. Your webserver's firewall is a host one, not an external router one. There is a big difference. Your webserver might be configured to think about itself only and your router's firewalling might consider everything from a high level. I don't think you need a complicated policy on your webserver but one that stops you accidentally exposing, say, a MariaDB/MySQL to the outside world because you bind it to all interfaces instead of just ::1.
dehrmann 3y ago
It's been forever since I really played with firewalls, but I remember pf being much more thought-out than iptables.

deleted 3y ago

[deleted]

BSDobelix 3y ago

Well there are some examples: https://github.com/freebsd/freebsd-src/tree/main/share/examples/pf https://github.com/freebsd/freebsd-src/tree/main/share/examp... But yeah that pf.conf could be expanded allot, but there are many source to cobble a conf together. My conf is massive but 99.9% commented out so i have my "template" for nearly everything, from mail to web to blacklistd etc.

torstenvl 3y ago
Have you considered putting your conf on GitHub? One of my most popular repos (which isn't saying a lot) is a single config file.
- BSDobelix 3y ago
  Let me think about it..it's really massive and has comments like "*uck that if scrub on" or "set aggressive -> emailservers try and try again" and those are the best understandable comments believe me. All is mixed from highly reliable and fast connections to dial-up "industry" stuff. However that would be a good motivation to clean that monster up...hmmm
  - tambourine_man 3y ago
    Do it! :)
adamddev1 3y ago
Those are great but I don't see anything for a web server. Would just love a webserver that works with IPv6 and handles all the ICMP filtering like ufw does out of the box.

gerdesj 3y ago

"Like getting the firewall pf set up" pfSense 2.7.0 is FreeBSD 14 based already and 2.7.1 was released todayish. You could try tearing their scripts apart to see what's what but bear in mind that pfSense is designed to be a router/firewall not a host based firewall, which sounds like what you really want. It sounds like you want ufw or firewalld for FreeBSD. No idea if it exists and I am well passed DIY - I had custom scripts for ipfw, ipchains and iptables on Linux and then gave up. I don't use FreeBSD on the desktop but if I did ... https://www.digitalocean.com/community/tutorials/how-to-configure-packet-filter-pf-on-freebsd-12-1 https://www.digitalocean.com/community/tutorials/how-to-conf... or keep it simple: https://www.digitalocean.com/community/tutorials/recommended-steps-for-new-freebsd-12-0-servers#how-to-configure-a-simple-ipfw-firewall https://www.digitalocean.com/community/tutorials/recommended... You mention a web server. I suggest you keep the host firewall simple, this is in pseudo code: allow ssh from LAN allow monitoring_ip to monitoring_ports drop blocklist_ips to ALL allow https from ALL to webserver_ip deny all Your external router should keep most things out, the host firewall is a last resort. If you have a flat LAN, then this will keep your TV out etc. I have seen a TV port scan my home network, multiple times. If you can, consider deploying multiple VLANs. This does raise the technical bar somewhat! Host firewalls are just as good for small setups. Decide on what your security requirements really are and work on from there. I will grant you that is quite tricky for the uninitiated but keep asking questions and ducking the inevitable "RTFM" style answers from entitled numbskulls and you will get there. Good luck 8)

adamddev1 3y ago
Thanks, I used that Digital Ocean tutorial, but it doesn't get into the ICMP filtering enough, which you need for IPv6. And the pseudo code you shared is nice, but again, IPv6 will not work with that. ufw comes with a base ruleset with like 100ish lines of complex ICMP filtering. It's difficult/impossible to expect everyone to be able to write something like that from scratch in a syntax like pf. I just wish there was a complete, good template out there, but I haven't found anything.
- gerdesj 3y ago
  ICMPv6 was designed to be a bit more robust than the v4 variant and I believe it is considered OK to allow all. I have six WANs at work - four FTTC 80/20Mbs-1, a 1Gbs-1 leased line and a 1000/300Mbs-1 FTTP job. All have IPv6 apart from the FTTP. I only push through the leased line /48 to inside but I do experiments with the IPv6 on the others. I have a /56 IPv6 at home too, for at least 10 years. I have allowed all ICMPv6 on two out of the four FTTC lines and not noticed much difference. The other two only allow "useful" ICMP, where useful is similar to this: http://firehol.org/guides/icmpv6-recommendations/ http://firehol.org/guides/icmpv6-recommendations/ Let your external router do the hard work. Your web server on the inside should allow all ICMPv6 in both directions. Just because it has a globally routeable IPv6 address(es) it is not on the outside. Your webserver's firewall is a host one, not an external router one. There is a big difference. Your webserver might be configured to think about itself only and your router's firewalling might consider everything from a high level. I don't think you need a complicated policy on your webserver but one that stops you accidentally exposing, say, a MariaDB/MySQL to the outside world because you bind it to all interfaces instead of just ::1.

dehrmann 3y ago

It's been forever since I really played with firewalls, but I remember pf being much more thought-out than iptables.